CVE-2024-9264

CVE-2024-9264 Аутентифицированный RCE в Grafana v11.0 через SQL Expressions — PoC-эксплойт CVE-2024-9264 — Grafana v11.0 Аутентифицированное удалённое выполнение кода RCE PoC Введение CVE-2024-9264 — это критическая уязвимость удалённого выполнения кода и локального включения файлов, появившаяся ...

CVE-2024-9264-RCE-Exploit

CVE-2024-9264-RCE-Exploit in Grafana via SQL Expressions Description Preuve de concept pour l'exécution de code à distance dans Grafana CVE-2024-9264 Ce dépôt contient un script Python qui exploite une vulnérabilité d'exécution de code à distance RCE dans la fonctionnalité SQL Expressions de...

CVE-2024-9264

CVE-2024-9264 - Эксплойт Grafana SQL Expressions DuckDB LFI/RCE PoC Эксплойт на Python для CVE-2024-9264, уязвимости Grafana SQL Expressions, которая позволяет аутентифицированному пользователю выполнять включение локальных файлов и команд, когда duckdb доступен в PATH процесса Grafana. Только дл...

day05-grafana-sqlexpr-lab

Jour 5 – Expressions SQL de Grafana → LFI DuckDB CVE-2024-9264 TL;DR: Sur les versions affectées de Grafana 11.x, un Viewer connecté peut utiliser les Expressions SQL. Grafana transmet l'expression à DuckDB sur le serveur. Avec readtext / readblob, vous pouvez lire des fichiers locaux LFI. Nous...

CVE-2024-9264-Fixed

🛠️ CVE-2024-9264 - Exploit RCE Grafana corrigé Ceci est une version corrigée de la preuve de concept de l'exploit pour CVE-2024-9264 , une vulnérabilité critique d'exécution de code à distance dans Grafana via les expressions SQL et DuckDB. 🔗 Avis original : Publication de sécurité de Grafana ❌ Po...

CVE-2026-27876

CVE-2026-27876: SQL-выражения Grafana — произвольная запись файлов с эскалацией до RCE CVSS 9.1 Critical | Произвольная запись файлов | Удалённое выполнение кода Демонстрация https://github.com/user-attachments/assets/c84a4b63-7928-4dba-a069-3bafa036ce56 Краткое описание Функция SQL-выражений...

CVE-2024-9264

CVE-2024-9264-RCE-Exploit dans Grafana via les expressions SQL Description Preuve de concept pour l'exécution de code à distance RCE dans Grafana CVE-2024-9264 Ce dépôt contient un script Python qui exploite une vulnérabilité d'exécution de code à distance RCE dans la fonctionnalité des expressio...

CVE-2026-27876

🚨 CVE-2026-27876 - RCE Critique dans Grafana via les Expressions SQL Une vulnérabilité enchaînée permettant des écritures arbitraires de fichiers via les Expressions SQL, menant à une exécution de code à distance RCE complète sur l'hôte. 📋 Aperçu ID CVE : CVE-2026-27876 Sévérité : Critique CVSS...

grafana: Grafana: Information disclosure via SQL Expressions vulnerability

A flaw was found in Grafana. An authenticated attacker can exploit a vulnerability in SQL Expressions to read arbitrary files from the Grafana server's filesystem. This information disclosure is possible only when the sqlExpressions feature toggle is enabled...

grafana: Grafana: Information disclosure via SQL Expressions vulnerability

A flaw was found in Grafana. An authenticated attacker can exploit a vulnerability in SQL Expressions to read arbitrary files from the Grafana server's filesystem. This information disclosure is possible only when the sqlExpressions feature toggle is enabled...

grafana: Grafana: Information disclosure via SQL Expressions vulnerability

A flaw was found in Grafana. An authenticated attacker can exploit a vulnerability in SQL Expressions to read arbitrary files from the Grafana server's filesystem. This information disclosure is possible only when the sqlExpressions feature toggle is enabled...

Access Control Bypass

Overview october/system is a System module for October CMS. Affected versions of this package are vulnerable to Access Control Bypass in the cms.safemode process. An attacker can gain unauthorized access to sensitive database information and impersonate other backend users by chaining method call...

Exploit for Code Injection in Grafana

CVE-2026-27876: Grafana SQL Expressions Arbitrary File Write t...

Exploit for Command Injection in Grafana

CVE-2024-9264 - Grafana SQL Expressions DuckDB LFI/RCE PoC Py...

GO-2026-5409 Grafana: SQL Expressions Read File From Disk in github.com/grafana/grafana

Grafana: SQL Expressions Read File From Disk in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please...

Linux Distros Unpatched Vulnerability : CVE-2026-33380

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability in SQL Expressions allows an authenticated attacker to read arbitrary files from the Grafana server's filesystem. Only instances with the...

BIT-GRAFANA-2026-33380 SQL Expressions Read File From Disk

A vulnerability in SQL Expressions allows an authenticated attacker to read arbitrary files from the Grafana server's filesystem. Only instances with the sqlExpressions feature toggle enabled are vulnerable...

SUSE CVE-2026-33380

A vulnerability in SQL Expressions allows an authenticated attacker to read arbitrary files from the Grafana server's filesystem. Only instances with the sqlExpressions feature toggle enabled are vulnerable...

EUVD-2026-30145

A vulnerability in SQL Expressions allows an authenticated attacker to read arbitrary files from the Grafana server's filesystem. Only instances with the sqlExpressions feature toggle enabled are vulnerable...

Grafana: SQL Expressions Read File From Disk

A vulnerability in SQL Expressions allows an authenticated attacker to read arbitrary files from the Grafana server's filesystem. Only instances with the sqlExpressions feature toggle enabled are vulnerable...